This is the first in a small series on some key reasons why written policy and procedure documentation is important to your small business or medical or dental practice, no matter how small you may be.

Not many of the smallest businesses that I commonly work with have yet to purchase cyber insurance but it's becoming more popular, quickly, especially with data-intensive businesses and those facing clear and strong information protection rules such as HIPAA-regulated healthcare entities and even their business associates.

When it comes time to purchase cybersecurity insurance, odds are that you will be expected to have a defined compliance program that includes comprehensive written privacy and security policies and procedures.

This is the first of our ongoing “use case” blog posts, where we take off from a real news story to explore key compliance principles. For a more detailed explanation of how our posts tagged with the “use case” label will work, see our other post from today.

This first “use case” post is interesting because it illustrates just how universal the need for a compliance program can be. And it shows a key way you might figure out what to include in your own compliance program, by looking at what outsiders (whether regulators, auditors, or, as in this case, researchers focused on your product or industry) may use to investigate your industry. It also touches on the benefits of simplification in the face of a slate of differing regulations.